Privacy Policy

1. About this Privacy Policy

This Privacy Policy explains how Lashline Studio Training Academy collects, uses, stores and shares personal information.

This policy applies when you:

• Visit our website
• Contact us with an enquiry
• Book or pay for a training course
• Attend an in-person or online course
• Complete assessments or course activities
• Receive a certificate of completion
• Subscribe to marketing communications
• Otherwise interact with the academy

We are committed to protecting your personal information and handling it fairly, lawfully and transparently.

2. Who we are

For the purposes of UK data protection law, the data controller is:

As the data controller, we decide how and why your personal information is used.

3. Personal information we collect

Depending on how you interact with us, we may collect the following information.

Identity and contact information

This may include:

• Your full name
• Email address
• Telephone number
• Home or billing address
• Date of birth, where required
• Emergency contact details, where applicable
• Parent or guardian details, where applicable
• Information contained in enquiries or correspondence

Booking and payment information

This may include:

• Courses booked
• Booking dates
• Payment amounts
• Payment status
• Billing information
• Invoice and transaction records
• Refund or cancellation information

Full payment card details are normally collected and processed directly by our payment provider. We do not normally receive or store your complete card details.

Course and training information

This may include:

• The course you are attending
• Attendance records
• Course progress
• Assessment results
• Tutor feedback
• Practical work completed
• Course communications
• Certificate details
• Certificate issue dates and reference numbers
• Records showing whether a certificate has been awarded

Website and technical information

When you use our website or online services, we may collect:

• Your IP address
• Browser and device information
• Approximate location information
• Pages viewed
• Links clicked
• The date and time of your visit
• How you reached our website
• Cookie identifiers
• Website preferences
• Analytics information

Marketing information

This may include:

• Your marketing preferences
• Records of your consent
• Whether you opened or interacted with a marketing message
• Records of unsubscribe requests
• Information about courses or services that may interest you

Complaints and rights requests

If you make a complaint or exercise a data protection right, we may collect:

• Details of your complaint or request
• Evidence of your identity
• Relevant correspondence
• The steps taken to investigate the matter
• Our decision and response

4. How we collect your information

We may collect information:

• Directly from you
• Through our website or contact forms
• When you book or purchase a course
• When you attend or complete training
• Through our payment, booking or course providers
• When you communicate with us by email, telephone, text message or social media
• Through cookies and similar technologies
• From a parent or guardian, where applicable
• From another person booking a course on your behalf

Where another person provides your information to us, they must have permission to do so.

5. How and why we use your information

We only use personal information where we have a lawful reason to do so.

To respond to enquiries

We use your contact details and enquiry information to respond to questions about our courses.

Our lawful basis is usually our legitimate interest in responding to prospective students and operating the academy. Where you are taking steps towards booking a course, our lawful basis may also be taking steps before entering into a contract.

To process bookings and deliver courses

We use your information to:

• Register you for a course
• Confirm your booking
• Provide course materials
• Deliver in-person or online training
• Communicate course arrangements
• Record attendance
• Assess your progress
• Provide student support
• Issue a certificate of completion

Our lawful basis is that the processing is necessary to perform our contract with you or to take steps at your request before entering into a contract.

To process payments and refunds

We use payment and billing information to:

• Collect course fees
• Issue invoices and receipts
• Process refunds
• Maintain financial records
• Prevent fraudulent payments

Our lawful bases are performing our contract with you, complying with legal obligations and our legitimate interest in protecting the academy against fraud.

To maintain course and certificate records

We keep course completion and certificate information to:

• Confirm that training has been completed
• Replace certificates where appropriate
• Respond to certificate verification requests
• Maintain accurate academy records
• Deal with complaints or disputes

Our lawful bases are performing our contract, complying with legal obligations and our legitimate interest in maintaining accurate training records.

We will only confirm certificate information to another person or organisation where you have requested it, authorised it or where we otherwise have a lawful reason to do so.

To operate and protect our business

We may use information to:

• Manage our administration
• Maintain records
• Protect our website and systems
• Prevent fraud or misuse
• Investigate complaints
• Obtain professional advice
• Establish, exercise or defend legal claims

Our lawful bases are our legitimate interests in operating and protecting the academy and complying with applicable legal obligations.

To improve our website and courses

We may use website activity, feedback and course information to understand how our services are used and improve them.

Where non-essential cookies or similar technologies are involved, we rely on consent where legally required.

For necessary website functions, security and limited business analysis, we may rely on our legitimate interests where the law permits.

To send marketing communications

We may use your contact details to send information about courses, offers, events or academy news.

We will send electronic marketing where:

• You have given your consent
• We are legally permitted to contact existing customers about similar services
• Another lawful marketing exception applies

You can unsubscribe at any time by using the unsubscribe option in a message or contacting us.

Our lawful basis is normally consent. Where the law allows us to contact existing customers without separate consent, we may rely on our legitimate interests alongside the applicable electronic marketing rules.

Messages concerning an existing booking, payment, course or certificate are service communications and are not marketing.

To comply with the law

We may use or disclose information where necessary to:

• Comply with tax and accounting requirements
• Respond to lawful requests
• Meet regulatory obligations
• Protect someone’s safety
• Prevent or investigate criminal activity
• Establish or defend legal claims

Our lawful basis is compliance with a legal obligation or, where applicable, our legitimate interests.

6. When you must provide information

You may choose whether to provide personal information to us. However, certain information is required so that we can:

• Process your booking
• Take payment
• Deliver your course
• Assess course completion
• Issue your certificate
• Comply with legal requirements

If you do not provide the necessary information, we may be unable to accept your booking or provide the course.

7. Who we share information with

We may share personal information with trusted third-party providers where necessary.

These may include:

• Website and hosting providers
• Customer management and booking system providers
• Payment processors
• Online course and video conferencing providers
• Email and text message providers
• Cloud storage and IT support providers
• Website analytics providers
• Advertising and social media platforms, where you have consented to relevant tracking
• Accountants, insurers, solicitors and professional advisers
• Government departments, regulators, courts or law enforcement agencies
• Certificate or training verification recipients authorised by you

These providers may process personal information on our behalf. They are only permitted to use the information for the relevant service and must protect it appropriately.

Some providers may act as separate data controllers and will have their own privacy policies.

We may also disclose information as part of a sale, restructuring or transfer of the academy, subject to appropriate confidentiality and data protection arrangements.

8. International transfers

Some of our service providers may store or access personal information outside the United Kingdom.

Where this involves a restricted international transfer, we will take steps to ensure that the information remains protected. This may include relying on:

• UK adequacy regulations
• Approved contractual safeguards
• The UK International Data Transfer Agreement
• The UK Addendum to approved standard contractual clauses
• Another transfer method permitted by UK data protection law

You may contact us for more information about the safeguards used for international transfers.

9. How long we keep information

We only keep personal information for as long as it is reasonably required for the purpose for which it was collected.

Enquiries

Enquiry records will normally be kept for up to 12 months after the last meaningful contact, unless you book a course or there is another reason to keep them.

Booking and course records

Booking, attendance, assessment and course administration records will normally be kept for up to six years after the course has ended.

Certificate records

Certificate and course completion records will normally be kept for six years after completion.

After that period, we may retain a limited record containing only the information reasonably required to verify that a certificate was issued.

Financial records

Invoices, payment records, refunds and related accounting information will normally be kept for up to six years after the relevant accounting period, or for any longer period required by law.

Marketing records

Marketing information will be kept until you withdraw your consent, unsubscribe or we determine that the information is no longer accurate or useful.

We may retain a minimal suppression record after you unsubscribe so that we can respect your request and avoid contacting you again.

Website analytics

Website analytics and cookie information will be kept according to the retention periods used by the relevant analytics service and described in our cookie settings or Cookie Policy.

Complaints and data protection requests

Complaint and rights request records will normally be kept for up to six years after the matter is closed, where necessary to demonstrate compliance or deal with related legal claims.

We may retain information for longer where:

• A legal claim or dispute is ongoing
• A regulator or court requires us to retain it
• There is suspected fraud or criminal activity
• Another legal or professional obligation applies

Information that is no longer required will be securely deleted or anonymised.

10. How we protect information

We use appropriate technical and organisational safeguards designed to protect personal information from:

• Unauthorised access
• Accidental loss
• Destruction
• Alteration
• Misuse
• Unlawful disclosure

These measures may include access restrictions, secure passwords, encryption, system updates, staff confidentiality requirements and secure service providers.

No method of storing or transmitting information is completely secure. However, we regularly consider the risks involved and take proportionate steps to protect the information we hold.

11. Cookies and website tracking

Our website may use cookies and similar technologies.

Cookies may be used to:

• Make the website work
• Remember your preferences
• Protect website security
• Understand website usage
• Measure marketing performance
• Display relevant advertising

Strictly necessary cookies may be used without consent where permitted by law.

Where consent is required, non-essential analytics, advertising and tracking technologies will not be used unless you have made a clear choice to accept them.

You can change or withdraw your cookie consent through our website’s cookie settings.

Further information about individual cookies, providers and retention periods should be provided in our Cookie Policy or cookie consent tool.

12. Your UK GDPR rights

Depending on the circumstances and the lawful basis being used, you may have the following rights.

Access your information

You can ask for confirmation of whether we hold your personal information and request a copy of it.

Correct inaccurate information

You can ask us to correct personal information that is inaccurate or complete information that is incomplete.

Request deletion

You can ask us to delete your personal information in certain circumstances.

This right does not apply where we are legally required or otherwise permitted to retain the information.

Restrict processing

You can ask us to temporarily restrict how we use your information in certain circumstances.

Data portability

Where processing is based on consent or a contract and is carried out by automated means, you may be able to request your information in a structured, commonly used and machine-readable format.

Withdraw consent

Where we rely on consent, you can withdraw it at any time.

Withdrawing consent does not affect processing that took place before the consent was withdrawn.

Object to direct marketing

If you object, we will stop using your information for that purpose.

Object to other processing

You may object to processing based on our legitimate interests.

We will stop the processing unless we have compelling legitimate grounds to continue or the information is required for legal claims.

Complain about our use of your information

You have the right to raise a complaint with us and with the Information Commissioner’s Office.

These rights are not absolute and may depend on the circumstances.

We will normally respond within the applicable legal time limit once we have enough information to understand the request and verify your identity.

You will not normally be charged for exercising your rights. We may charge a reasonable fee or refuse a request where the law allows us to do so, such as where a request is manifestly unfounded or excessive.

To exercise a right, contact: INSERT ACADEMY EMAIL ADDRESS

We may ask for information to confirm your identity before releasing personal information.

13. Automated decision-making

We do not currently use personal information to make decisions based solely on automated processing that produce legal or similarly significant effects on students.

We will update this Privacy Policy if that changes.

14. Students under 18

Our courses are available to students aged INSERT MINIMUM AGE .

Where we accept a student under the age of 18, we may require information and consent from their parent or legal guardian.

We will only collect information that is reasonably necessary to administer the course, communicate with the student and guardian, and protect the student’s welfare.

We will explain our use of the student’s information in clear and appropriate language.

15. Data protection complaints

You can complain to us if you believe that we have not handled your personal information correctly.

Complaints should be sent to:

Please include:

• Your name and contact details
• A description of the issue
• The outcome you are seeking
• Copies of relevant documents or correspondence

We will:

• Provide a clear way for you to raise the complaint
• Acknowledge your complaint within 30 days
• Take appropriate steps to investigate it without undue delay
• Keep you informed about the investigation where appropriate
• Tell you the outcome of the complaint

We encourage you to contact us first so that we have the opportunity to resolve the issue.

You also have the right to complain to the Information Commissioner’s Office, which is the United Kingdom’s data protection regulator.

16. Third-party websites

Our website may contain links to websites or services operated by other organisations.

We are not responsible for their privacy practices. You should read the privacy policy of any external website or service before providing personal information.

17. Changes to this Privacy Policy

We may update this Privacy Policy when:

• Our services change
• We begin using different providers
• Our data handling practices change
• Data protection law or regulatory guidance changes

The latest version will be published on our website with the updated date shown at the top.

18. Contact us

For questions about this Privacy Policy, your personal information or your data protection rights, please contact us.